XCSSET v40: From Xcode Supply Chain to Memory-Resident and Browser/Telegram Hijacking

Source: dev.to · Published: 2026-08-01

<h1> XCSSET v40: From Xcode Supply Chain to Memory-Resident and Browser/Telegram Hijacking </h1>

<h2> 1. Basic Information </h2>

<ul> <li> <strong>Article Title</strong>: The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version</li> <li> <strong>Publisher</strong>: Unit 42</li> <li> <strong>Publication Date</strong>: 2026-07-31</li> <li> <strong>Severity</strong>: High</li> <li> <strong>Original Source</strong>: <a href="https://unit42.paloaltonetworks.com/xcsset-v40-malware-analysis/" rel="noopener noreferrer">https://unit42.paloaltonetworks.com/xcsset-v40-malware-analysis/</a> </li> <li> <strong>Related Malware</strong>: XCSSET v40</li> <li> <strong>Threat Actor</strong>: XCSSET operators (Unattributed)</li> <li> <strong>CVE</strong>: None</li> <li> <strong>Products/Environments</strong>: macOS, Xcode, Google Chrome, Telegram</li> </ul>

<h3> Related Sources </h3>

<ul> <li><a href="https://www.microsoft.com/en-us/security/blog/2025/09/25/xcsset-evolves-again-analyzing-the-latest-updates-to-xcssets-inventory/" rel="noopener noreferrer">Microsoft's 2025 XCSSET Analysis</a></li> </ul>

<h2> 2. Executive Summary </h2>

<p>A macOS supply chain attack that starts with building a legitimate Xcode project. After C2 approval, a multi-stage loader executes 17 modules in memory to hijack Chrome sessions and the Telegram app.</p>

<h2> 3. Attack Flow </h2>

<h3> Xcode Supply Chain Infection </h3>

<ol> <li>Attackers inject a malicious run-script into a legitimate Xcode project on platforms like GitHub.</li> <li>A developer builds the project locally and runs the script, which is obfuscated using Hex/Base64.</li> <li>The script uses <code>curl</code> to connect to <code>/a</code> on the C2 server with <code>p=xcode_phase</code>, sending system info like <code>uname</code> and <code>whoami</code>.</li> <li>If the C2 server approves the target, the bash stager checks the serial number and creates <code>/tmp/r</code> and/or <code>/tmp/p.app</code>.</li> <li>It uses <code>osascript</code> to run the boot orchestrator in memory, then deletes the temporary files and staging processes.</li> <li>The boot orchestrator downloads encrypted modules from <code>/s/<encoded_module_name></code> to steal browser data, log keys, access the clipboard, and exfiltrate information.</li> <li>It self-replicates into other existing Xcode projects on the infected machine to spread to the next developer and build artifacts.</li> </ol>

<h3> Chrome/Telegram Hijacking </h3>

<ol> <li>It wraps legitimate Chrome in a malicious wrapper to restart the boot orchestrator every time Chrome launches.</li> <li>It launches Chrome with CDP (Chrome DevTools Protocol) enabled arguments and a fixed local port.</li> <li> <code>chrome_remote</code> connects to CDP to run arbitrary JavaScript, extract cookie tokens, and control existing sessions.</li> <li>Another module deletes the legitimate <code>Telegram.app</code>, replaces it with a fake app from a C2 ZIP file, and applies an ad-hoc signature.</li> <li>It terminates the legitimate process so the user runs the trojanized Telegram when they restart the app.</li> </ol>

<h2> 4. Attacker Positions and Execution Locations </h2>

<ul> <li> <strong>Attacker Positions</strong>: Code supply sources like GitHub, and rotating C2 servers.</li> <li> <strong>Execution Locations</strong>: Developer macOS, Xcode build phases, bash/osascript/Chrome CDP, and the replaced Telegram.app.</li> <li> <strong>Secondary Spread Points</strong>: Other Xcode projects on the infected machine.</li> </ul>

<h2> 5. Visibility for Victims and Administrators </h2>

<h3> Victims and Users </h3>

<ul> <li>Infection happens simply by building a project downloaded as usual, and the finished app may look completely normal.</li> <li>If TCC permissions are denied, fake re-prompts may appear, masquerading as System Settings or Xcode.</li> </ul>

<h3> Administrators and SOCs </h3>

<ul> <li> <code>curl</code>, <code>bash</code>, and <code>osascript</code> spawned from Xcode, along with short-lived creation of <code>/tmp/r</code> and <code>/tmp/p.app</code>.</li> <li>Chrome remote-debugging/CDP arguments and unusual launcher paths.</li> <li>Random domains/keys added to <code>defaults</code>, Perl processes holding XProtect XPdb, and termination of <code>CloudTelemetryService</code>.</li> </ul>

<h2> 6. Success and Failure Conditions </h2>

<h3> Success Conditions </h3>

<ul> <li>An Xcode project containing a malicious run-script is built.</li> <li>The machine reaches the C2 server, and the C2 approves the host profile.</li> <li>Standard tools like <code>osascript</code>, <code>curl</code>, and <code>defaults</code> are allowed to run.</li> <li>The user grants (or has already granted) necessary TCC/AppleEvents permissions.</li> </ul>

<h3> Failure Conditions </h3>

<ul> <li>Code and dependency checks before building detect the run-script.</li> <li>C2 domains, IPs, or SSL fingerprints are blocked by DNS or egress filters.</li> <li>EDR stops Xcode child processes or CDP enablement.</li> <li>The machine is detected as a VM (additional modules will not be downloaded).</li> <li>The user denies TCC re-prompts and isolates the device.</li> </ul>

<h2> 7. What Happens on Success </h2>

<ul> <li>Theft of Chrome cookie tokens and logged-in sessions.</li> <li>Persistent replacement of the Telegram app and establishment of a foothold inside the app.</li> <li>Collection and exfiltration of credentials, clipboard data, keystrokes, browser extensions, and local files.</li> <li>Supply chain expansion via reinfection of local Xcode projects.</li> <li>Interference with SoftwareUpdate, XProtect, CloudTelemetry, and TCC to delay detection and remediation.</li> </ul>

<h2> 8. Observable Logs </h2>

<h3> Email </h3>

<ul> <li>No direct email vector. Subsequent email activity using stolen sessions is inferred.</li> </ul>

<h3> Proxy/SWG/DNS </h3>

<ul> <li>HTTPS requests to <code>/a</code>, <code>/s/<encoded_module_name></code>, <code>/w?<cmd></code>, and <code>/e</code>, connections to enumerated <code>.ru</code>/<code>.in</code> C2 servers, and rapidly changing encrypted blobs.</li> </ul>

<h3> Endpoint/EDR </h3>

<ul> <li>Xcode spawning <code>sh</code>/<code>bash</code>/<code>curl</code>/<code>osascript</code>, creation of <code>/tmp/r</code> and <code>/tmp/p.app</code>, <code>boot</code>, <code>chrome_remote</code>, <code>defaults write</code>/<code>read</code>, <code>tccutil reset AppleEvents</code>, Perl holding XPdb locks, and termination of <code>CloudTelemetryService</code>.</li> </ul>

<h3> Identity/IdP </h3>

<ul> <li>Reuse of Chrome cookies and access to existing sessions from unusual devices or User-Agents.</li> </ul>

<h3> SaaS/Cloud </h3>

<ul> <li>Suspicious commits to GitHub repositories, use of compromised developer tokens, and abnormal Telegram data/session activity.</li> </ul>

<h3> Network </h3>

<ul> <li>C2 IP addresses, shared SSL thumbprint <code>6e480d648fa1b70612f5d198a66875e28847547d</code>, and Chrome local CDP ports.</li> </ul>

<h2> 9. Attack Success Stages </h2>

<ul> <li> <strong>Contact Only</strong>: Viewing or cloning a malicious repository without building.</li> <li> <strong>User Action</strong>: Building the infected project.</li> <li> <strong>Initial Execution</strong>: <code>curl</code> to <code>/a</code> from an Xcode child process and execution of the stager.</li> <li> <strong>Malware Success</strong>: <code>boot</code> runs and fetches modules from <code>/s/</code>.</li> <li> <strong>Information Theft & Session Compromise</strong>: Exfiltration of cookies/clipboard/Telegram data, and use of stolen cookies.</li> <li> <strong>Secondary Compromise</strong>: Tampering with other projects, external commits, and continuous execution of the trojanized app.</li> </ul>

<h2> 10. Investigation Playbook </h2>

<ul> <li> <strong>Trigger</strong>: Xcode spawning <code>curl</code>/<code>osascript</code>, Chrome CDP, XCSSET C2/SSL fingerprints.</li> <li> <strong>Initial Verification</strong>: Isolate the clone source, commit SHA, build time, and parent-child process/network connections.</li> <li> <strong>Endpoint Analysis</strong>: Collect <code>/tmp</code> remnants, <code>defaults</code> domains, LaunchDaemons, Git hooks, replaced Chrome/Telegram apps, ad-hoc signatures, and TCC history.</li> <li> <strong>Identity & Cloud</strong>: Revoke GitHub PAT/SSH keys, browser sessions, and Telegram sessions, and audit commits by the same developer.</li> <li> <strong>Secondary Actions</strong>: Rescan all Xcode projects and build artifacts, and search enterprise-wide for the same C2 communications.</li> <li> <strong>Containment</strong>: Isolate macOS devices, revoke tokens, block C2 servers, rebuild from trusted media, and remove tainted commits.</li> <li> <strong>Severity Levels</strong>: Exposure / Build Executed / Loader Confirmed / Module Execution / Session Theft / Supply-chain Propagation</li> </ul>

<h2> 11. Defense and Detection Ideas </h2>

<ul> <li> <strong>Single Indicators</strong>: Xcode spawning <code>curl</code>, <code>tccutil reset AppleEvents</code>, Chrome remote-debugging, and high-entropy payloads in <code>defaults</code>.</li> <li> <strong>Correlated Indicators</strong>: Project build -> <code>/a</code> beacon -> <code>/tmp</code> applet -> <code>osascript</code> -> deletion of temporary items -> module fetch.</li> <li> <strong>Threat Hunting</strong>: Replaced Chrome launchers, Telegram.app hash/signature mismatches, Git hooks, unusual <code>defaults</code> domains, and failed XProtect updates.</li> <li> <strong>Log Gaps</strong>: macOS process command lines, ESF/file events, DNS/TLS data, Git audits, and browser/IdP session telemetry.</li> <li> <strong>Priority Countermeasures</strong>: Locking and signing development dependencies, reviewing Xcode run-scripts, installing EDR on developer Macs, shortening token lifespans, and enforcing egress controls.</li> </ul>

<h2> 12. Facts, Inferences, and Hypotheses </h2>

<h3> Facts </h3>

<ul> <li>Attacks via Xcode projects of legitimate apps have been observed since April 2026.</li> <li>Version 40 uses a 4-stage loader to run <code>boot</code> and 17 modules primarily in memory.</li> <li>Eight different loader hashes were delivered to a single endpoint within 24 hours.</li> <li>Abuse of Chrome CDP and replacement of <code>Telegram.app</code> were confirmed.</li> <li>Fileless reinfection via <code>defaults</code>, interference with XProtect/Telemetry/TCC, and anti-VM checks were confirmed.</li> </ul>

<h3> Inferences </h3>

<ul> <li>Engineering organizations using external open-source or contractor projects face similar risks regarding supply chain infection.</li> <li>Combining build-derived process chains and C2 URIs provides more stable detection than relying on hashes alone.</li> </ul>

<h3> Hypotheses </h3>

<ul> <li>If a compromised developer's signing credentials or CI tokens are stolen, the attack could spread to legitimately signed build artifacts, though this has not been confirmed in this case.</li> </ul>

<h2> 13. MITRE ATT&CK Mapping </h2>

<ul> <li> <strong>T1195.002 – Compromise Software Supply Chain</strong> (Confidence: High)</li> <li> <strong>T1059.004 – Unix Shell</strong> (Confidence: High)</li> <li> <strong>T1059.002 – AppleScript</strong> (Confidence: High)</li> <li> <strong>T1027 – Obfuscated/Compressed Files and Information</strong> (Confidence: High)</li> <li> <strong>T1546.004 – Unix Shell Configuration Modification / Git hook persistence equivalent</strong> (Confidence: Medium)</li> <li> <strong>T1555.003 – Credentials from Web Browsers</strong> (Confidence: High)</li> <li> <strong>T1562.001 – Impair Defenses</strong> (Confidence: High)</li> <li> <strong>T1105 – Ingress Tool Transfer</strong> (Confidence: High)</li> <li> <strong>T1041 – Exfiltration Over C2 Channel</strong> (Confidence: High)</li> </ul>

<h2> 14. Open Questions and Further Investigation </h2>

<ul> <li>Initial repository tampering vectors and a complete list of affected projects.</li> <li>Full features of the replaced Telegram version and contents of <code>~/.tr</code> settings.</li> <li>Whether infections have occurred globally.</li> <li>Actual instances of stolen cookie usage.</li> <li>The extent of contamination spreading from infected projects to distributed artifacts.</li> </ul>

<h2> 15. Impact on SOCs and Organizations </h2>

<p>This threat directly affects Apple developers, game studios, fintech/payment apps, and outsourced software development companies. Because developer workstations hold GitHub tokens, signing keys, and cloud credentials, a single endpoint infection must be treated as a supply chain incident. Organizations must investigate not only the workstation but also repositories, CI/CD pipelines, and distributed artifacts.</p>

<h2> 16. Summaries by Target Audience </h2>

<h3> For SOCs </h3>

<p>Correlate Xcode-initiated <code>curl</code>/<code>osascript</code>, Chrome CDP, <code>defaults</code> persistence, and C2 SSL fingerprints chronologically, without relying on rotating hashes.</p>

<h3> For Administrators </h3>

<p>Isolate developer Macs and inspect projects, Git history, code signatures, and tokens. Fix upstream sources to prevent reinfection from tainted repositories even after rebuilding the OS.</p>

<h3> For Users </h3>

<p>Even Xcode projects from seemingly legitimate sources can infect your machine during the build process. Do not approve unexpected AppleEvents permission requests or sudden Chrome/Telegram restarts; report them immediately.</p>